Organization Configuration

A guide to configuring and structuring your AWS Organization for multi-account governance. AWS Organizations is the foundation for managing multiple AWS accounts under a single governance model. Proper configuration ensures consistent security policies, cost allocation, and operational visibility across your entire environment.

Organization Structure

A well-designed organizational unit (OU) hierarchy enables you to apply policies at the right level of granularity.

Recommended OU Structure

Root
├── Security
│   ├── Audit (Log Archive)
│   └── Security Tooling
├── Infrastructure
│   ├── Shared Services
│   └── Networking
├── Workloads
│   ├── Production
│   ├── Staging
│   └── Development
├── Sandbox
│   └── Individual Developer Accounts
└── Suspended
    └── Decommissioned Accounts

Design Principles

Separate security from workloads: Security accounts (audit, log archive) should be in their own OU with strict SCPs.
Environment isolation: Production, staging, and development workloads in separate OUs allow different policy sets.
Sandbox for experimentation: Give developers a safe space with spend limits but relaxed controls.
Suspended OU: Move accounts here before deletion to ensure all SCPs deny actions while you audit.

Enabling Organization Features

Ensure your organization has all features enabled (not just consolidated billing):

aws organizations describe-organization

Look for "FeatureSet": "ALL". If you see "CONSOLIDATED_BILLING", enable all features:

aws organizations enable-all-features

Service Control Policies (SCPs)

SCPs are the primary governance mechanism. They define the maximum permissions available to accounts within an OU.

Common SCPs

Policy	Purpose	Applied To
Deny Root User Actions	Prevent root user usage in member accounts	All OUs except management
Deny Region Access	Restrict workloads to approved regions only	Workloads OU
Deny Leave Organization	Prevent accounts from leaving the org	Root (all accounts)
Require Encryption	Deny creation of unencrypted resources	Production OU
Deny Public S3	Block public access on S3 buckets	All OUs

SCP Best Practices

Start with a deny-list approach: allow everything by default, explicitly deny what’s not permitted.
Test SCPs in the Sandbox OU before rolling to production.
Never attach restrictive SCPs directly to the root — use OUs for granularity.
Keep the management account free of restrictive SCPs (it is always exempt from SCPs by design, but avoid confusion).

Delegated Administrators

Delegate service administration to member accounts so the management account remains minimal:

Service	Delegate To
AWS Security Hub	Security Tooling account
Amazon GuardDuty	Security Tooling account
AWS Config (Aggregator)	Audit account
AWS Firewall Manager	Security Tooling account
AWS IAM Identity Center	Infrastructure account

aws organizations register-delegated-administrator \
  --account-id 111111111111 \
  --service-principal securityhub.amazonaws.com

Tag Policies

Enforce consistent tagging across all accounts:

{
  "tags": {
    "Environment": {
      "tag_key": {
        "@@assign": "Environment"
      },
      "tag_value": {
        "@@assign": ["production", "staging", "development", "sandbox"]
      },
      "enforced_for": {
        "@@assign": ["ec2:instance", "s3:bucket", "rds:db"]
      }
    }
  }
}

Trusted Access

Enable trusted access for AWS services that need organization-wide visibility:

AWS CloudFormation StackSets
AWS Config
AWS CloudTrail (organization trail)
AWS Backup
AWS RAM (Resource Access Manager)

aws organizations enable-aws-service-access \
  --service-principal config.amazonaws.com

Consolidated Billing & Cost Allocation

Enable Cost Allocation Tags in the management account billing console.
Use AWS Cost Explorer for cross-account cost visibility.
Set up AWS Budgets at both the organization and individual account levels.

Overview

Core Services

Engagement Models

Outside Resources

Organization Structure

Recommended OU Structure

Design Principles

Enabling Organization Features

Service Control Policies (SCPs)

Common SCPs

SCP Best Practices

Delegated Administrators

Tag Policies

Trusted Access

Consolidated Billing & Cost Allocation

Next Steps

​Organization Structure

​Recommended OU Structure

​Design Principles

​Enabling Organization Features

​Service Control Policies (SCPs)

​Common SCPs

​SCP Best Practices

​Delegated Administrators

​Tag Policies

​Trusted Access

​Consolidated Billing & Cost Allocation

​Next Steps

Organization Structure

Recommended OU Structure

Design Principles

Enabling Organization Features

Service Control Policies (SCPs)

Common SCPs

SCP Best Practices

Delegated Administrators

Tag Policies

Trusted Access

Consolidated Billing & Cost Allocation

Next Steps